面向运行时行为的Android恶意应用检测系统的设计与实现

With the rapid development of mobile Internet and the growing number of Android malicious applications, the detection of malicious applications has become a hot topic in academia and industry. In this paper, a malicious application detection system for Android is proposed, which uses C/S architecture. The client injects process and dynamicly changes virtual machine instance, to achieve real-time interception of the Android API and upload behavior records. Through the analysis of the behavioral records and the recognition based on machine learning, the server realizes the effective classification of the applications. The experiment is conducted with 1000 real-world applications and the results show that the system can effectively detect unknown malicious applications.